Splunk 9.0.4 Custom Attachment Name for Emails from Saved Search

landrujw — Thu, 30 Mar 2023 19:51:38 GMT

I need to change the format of the name of the .csv attachments on reports from my organization's saved searches. I've gone through the older solutions but they don't seem to be valid anymore.
The goal is when a report sends an email with a .csv attachment to have the timestamp be "$name$-$time:%Y-%m-%d-%H:%M:%S$" instead of just "$name$-$time:%Y-%m-%d".
Neither setting the reportFileName in alert_actions.conf or adding an action.email.reportFileName line to the saved search itself is changing the name of the file. Is there a workaround for Splunk 9?

Re: Splunk 9.0.4 Custom Attachment Name for Emails from Saved Search

Gr0und_Z3r0 — Sat, 01 Apr 2023 05:15:44 GMT

Hi @landrujw

One way to do it would be, in the search set the current time in whichever format you want in a field.
And use this field in the report name. Something like this "$name$ - $myReportTime$"

~ If the reply helps, a Karma upvote would be appreciated.

topic Splunk 9.0.4 Custom Attachment Name for Emails from Saved Search in Alerting

Splunk 9.0.4 Custom Attachment Name for Emails from Saved Search

Re: Splunk 9.0.4 Custom Attachment Name for Emails from Saved Search